VPNInfobaseWhat the register cannot tell you about ExpressVPN
ExpressVPN’s vendor pages name Kape as its ultimate holding company. They do not name an individual owner, and the register’s person-level owner entry rests on Wikipedia alone. The 1-month and 1-year prices were not readable on the order page (only the 28-month tab renders in static HTML), so only the long term is recorded.
Price: what a 28-month deal turns into
The register records the Basic plan at $2.99 a month for the first 28 months ($83.72), renewing at $99.95 a year. Averaged over 36 months by the method on the renewal price table, that is about $4.18 a month. Re-reading the order page on 29 September from a different location showed euro prices (EUR 69.72 for 28 months, renewing at EUR 79.95 a year), so check the total at checkout. The refund window is 30 calendar days for new subscribers, not renewals.
The audits: a long list, one kind of no-logs assurance
ExpressVPN’s trust page lists 28 audits, and most are security tests of individual apps and its Lightway protocol, mainly by Cure53. The no-logs assurance is a separate group: PwC Switzerland (2019), KPMG (September 2022, December 2023) and a KPMG engagement announced in June 2025 (the trust page and post headline call it the third; the post body calls it the second assessment, so the count is the vendor’s own inconsistency). The vendor says that last one examined “TrustedServer system and privacy policy claims as of 28 February 2025” under ISAE (UK) 3000 Type 1, which describes the design at a single date. Several older entries have no linked report. The audit tracker shows how this compares with others.
Ownership, and an incident that was not a breach
ExpressVPN is operated by Express Technologies Ltd., based in the British Virgin Islands; Kape is the named ultimate holding company, and the ownership table shows Kape’s other VPNs. In September 2021 ExpressVPN published a response to news reports about an executive’s earlier work on Project Raven, saying it does not condone Project Raven. That is not a breach of its systems; the incidents timeline files it as governance.
Who it fits, going by the register fields
- Pick it if you want the longest audit list on the register, vendor-stated RAM-only servers on all servers, and you are happy to check the renewal price after the first term.
- Look at others if you need open-source clients (only the Lightway core is stated as open source), a published individual owner, or a renewal price near the first-term price.
This is our reading of the register, not a measured result.
Alternatives
- NordVPN: six audits from PwC and Deloitte, a different parent
- Surfshark: Deloitte no-logs reports kept in an account
- Proton VPN: annual no-logs audits by Securitum